November 2024 - NANOG - lists.nanog.org

Spoofer Report for NANOG for Oct 2024
by CAIDA Spoofer Project 08 Nov '24

08 Nov '24

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Oct 2024: ASN Name Fixed-By 19126 KIZAWIRELESS 2024-10-01 55 UPENN 2024-10-02 394195 CLEARNETWORX 2024-10-16 199203 2024-10-18 14031 SCXY 2024-10-30 54600 PEGTECHINC 2024-10-31 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Oct 2024: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2024-10-11 40676 AS40676 2016-08-29 2024-10-28 27364 ACS-INTERNET 2016-09-27 2024-10-29 20412 CLARITY-TELECOM 2016-09-30 2024-10-31 12083 WOW-INTERNET 2016-11-09 2024-10-14 23314 ORLANDOTELCO 2017-04-14 2024-10-21 2152 CSUNET-NW 2017-11-08 2024-10-30 21804 ACCESS-SK 2019-06-09 2024-10-21 12183 TALKIE-COMMUNICATIONS 2022-12-10 2024-10-26 3701 NERONET 2023-04-18 2024-10-26 400282 2023-04-27 2024-10-30 393577 SCCNET 2023-05-03 2024-10-24 202400 2023-05-08 2024-10-21 61461 Airtek Solutions C.A. 2023-05-13 2024-10-31 20119 ARROW 2023-10-19 2024-10-31 394684 WISPERNET 2024-01-17 2024-10-26 394195 CLEARNETWORX 2024-03-22 2024-10-10 40850 ENKI 2024-04-03 2024-10-30 393530 TLU 2024-05-22 2024-10-30 19935 CRRS 2024-05-29 2024-10-29 3801 MISNET 2024-09-09 2024-10-29 30475 WEHOSTWEBSITES-COM 2024-09-30 2024-10-14 13807 GREAT-PLAINS-COMMUNICATIONS 2024-10-09 2024-10-09 20260 SAWTEL-UC 2024-10-16 2024-10-23 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

IPXO?
by Bryan Holloway 07 Nov '24

07 Nov '24

Anyone have any experiences -- good or bad -- with IPXO for IP address leasing? Either as a lessee or lessor? Feel free to respond off-list if you prefer.

3 2

Stream N92 Videos Now! Early Registration Ends Sunday
by Nanog News 07 Nov '24

07 Nov '24

*** N93 Early Registration Ends Sunday* ------------------------------------------------------------ *Don't Miss Your Opportunity for Discounted Registration Rates* Join us from Feb. 3-5, 2025 in Atlanta, GA for our next meeting, NANOG 93. Dive into the latest in networking tech and trends! *REGISTER NOW* <https://nanog.org/events/nanog-93/> *** Stream NANOG 92 Videos Now!* ------------------------------------------------------------ *Grab Some Popcorn + Watch Full N92 Playlist Now* *WATCH NOW <https://www.youtube.com/playlist?list=PLO8DR5ZGla8jZuNZqoXorIMACIUFeEfzd>* *** Check Out NANOG 92 Hackathon Recap* ------------------------------------------------------------ *Watch the Hackathon Wrap Up From our Last Meeting* *WATCH NOW <https://www.youtube.com/watch?v=4ijLfyqUjME&list=PLO8DR5ZGla8jZuNZqoXorIMAC…>* *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

A plea to ignore abuse reports from "watchdogcyberdefense.com"
by Pierre Bourdon 07 Nov '24

07 Nov '24

Hi nanog, Some of you might have seen https://delroth.net/posts/spoofed-mass-scan-abuse/ circulating last week (it was also sent here in reply to someone who received abuse complaints from their ISP). The TL;DR is that some previously unknown company with a fancy looking domain name has started noticing the background noise on the internet and is sending automated abuse complaints to any owner of a source IP sending a SYN packet to port 22 on their network. They're not doing any filtering to try to prevent spoofed source addresses, and at this point there's plenty of evidence that they are seeing mostly spoofed src IPs, then sending abuse reports to a completely uninvolved owner of the IP. I've recently been in communication with that company. They sent me an email trying to get "advice" from me about how to not send abuse complaints to the whole internet, while ignoring the obvious answer of "don't mass send automated abuse complaints based on no evidence of abuse and no evidence of who sent you traffic". They're also making wild claims in their email to me, like, I quote, seeing "1.3 billion attacks logged in the past 24 hours". They're saying that they act on data sources like "we query the VirusTotal API for the source IP and it shows us it's infected with malware". If you're a NOC or someone handling abuse complaints for an ISP or a hosting provider, this is my plea to you: please send abuse reports from "watchdogcyberdefense.com" to your spam box until they understand 1. that a TCP SYN packet is spoofable; 2. that they're harming the internet through reducing trust in abuse complaints by sending so many false positives. I've myself had interactions with both Hetzner and Linode's abuse team, both of them have been top notch and understood what they're likely dealing with, but having to explain to every single ISP what's going on while sitting in the equivalent of an interrogation room threatened with a service suspension isn't a very comfortable situation. Thank you in advance, Best, -- Pierre Bourdon <delroth(a)gmail.com> Software Engineer @ Zürich, Switzerland https://delroth.net/

7 6

Upcoming changes to the DNSSEC root trust anchor
by Andres Pavez 05 Nov '24

05 Nov '24

Dear Colleagues, We are reaching out to inform you of important changes to the DNSSEC trust anchor in the root zone. If you manage a validating DNS resolver or a tool that interacts with the DNS root zone you might need to change your software to handle the changes. This letter provides a summary of the upcoming changes and gives pointers to resources that describe them in detail. *Upcoming addition of the KSK-2024 trust anchor* On January 11, 2025, a new trust anchor, codenamed KSK-2024, will appear in the root zone for the global DNS. This key was generated earlier this year and will co-exist with the current trust anchor, codenamed KSK-2017. The new DNSKEY record is: . 172800 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/c idltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHb GiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+s iFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqp dVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ 1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUe ayffKC73PYc= As a result of this addition, some DNS responses may be larger during the transition period. If your software uses the RFC 5011 process for managing trust anchors, KSK-2024 will be automatically trusted about one month after its introduction to the root zone. There are two important planned dates: * October 11, 2026: KSK-2024 will begin signing the root zone. * January 11, 2027: KSK-2017 is scheduled to be revoked. For a detailed description of the rollover process, please refer to https://www.iana.org/dnssec/files *New trust anchor file* IANA has issued a new trust anchor file using the updated XML format described in https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7958bis/ , which has recently been approved to be published as an RFC. The new trust anchor file contains additional data that was not provided in previous versions of the file. If your software or processes use the IANA trust anchor file (published at https://data.iana.org/root-anchors/root-anchors.xml ), you should ensure you have processes to retrieve it regularly (such as weekly) and check your systems can process the revised format of the file. *Keep in touch* Operational announcements regarding trust anchors and rollovers are published on the root-dnssec-announce mailing list at https://lists.icann.org/postorius/lists/root-dnssec-announce.icann.org/ . A separate ksk-rollover mailing list is a forum for discussion specific to rollovers can be found at https://lists.icann.org/postorius/lists/ksk-rollover.icann.org/ . Best regards, -- Andres Pavez Cryptographic Key Manager

1 0

J Root woes on v4
by Eric Dugas 04 Nov '24

04 Nov '24

Hello, It seems that J Root has suboptimal routing over v4 but v6 is OK from my POV in Montreal, Canada. Route changes occurred ~5h ago. v4: ~260ms somewhere in Asia via our HE bilateral in Montreal, Canada (AS-PATH 6939 45629 55423 55423 26415 396651 396651) 55423 might host a legit J Root node, but it should be exported outside their region by AS45629 or HE. v6: ~24ms in Chicago via Arelion IPT in Montreal, Canada (AS-PATH 1299 7342 36631 36631) This one looks legit. Eric

1 0

Microsoft NOC Contact - ASN Association Request
by Christopher Hawker 04 Nov '24

04 Nov '24

Hello all, If anyone from AS8075 is lurking around, could you please reach out to me off-list? Backstory: We submitted an ASN Association (not peering) request to associate our AS with an Azure tenancy, and they rejected the request on the grounds that they "currently don't see any traffic for ASN". Regards, Christopher Hawker

2 2

IANA IPv6 Global Unicast Address Assignments Registry Update
by David Dong 02 Nov '24

02 Nov '24

Hi, The IANA IPv6 Global Unicast Address Assignments registry has been updated to reflect the allocation of the following block to APNIC: 2410::/12 APNIC 2024-11-01 You can find the registry at: https://www.iana.org/assignments/ipv6-unicast-address-assignments/ The allocation was made in accordance with the Policy for Allocation of IPv6 Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/allocation-ipv6-rirs-2012-02-25-en Best Regards, David Dong IANA Services Sr. Specialist

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 01 Nov '24

01 Nov '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 02 Nov, 2024 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 966387 Prefixes after maximum aggregation (per Origin AS): 367550 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 469509 Number of IPv4 prefixes with a valid ROA: 319991 Number of IPv4 prefixes with an invalid ROA: 1195 Number of IPv4 prefixes with no ROA: 645201 Total ASes present in the Internet Routing Table: 76413 Prefixes per ASN: 12.65 Origin-only ASes present in the Internet Routing Table: 65461 Origin ASes announcing only one prefix: 26839 Transit ASes present in the Internet Routing Table: 10952 Transit-only ASes present in the Internet Routing Table: 527 Average AS path length visible in the Internet Routing Table: 5.3 Max AS path length visible: 56 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 985 Number of instances of unregistered ASNs: 999 Number of 32-bit ASNs allocated by the RIRs: 45690 Number of 32-bit ASNs visible in the Routing Table: 37368 Prefixes from 32-bit ASNs in the Routing Table: 194235 Number of bogon 32-bit ASNs visible in the Routing Table: 59 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 527 Number of addresses announced to Internet: 3027561472 Equivalent to 180 /8s, 116 /16s and 236 /24s Percentage of available address space announced: 81.8 Percentage of allocated address space announced: 81.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 315863 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 258131 Total APNIC prefixes after maximum aggregation: 75713 APNIC Deaggregation factor: 3.41 Prefixes being announced from the APNIC address blocks: 249992 Unique aggregates announced from the APNIC address blocks: 101376 APNIC Region origin ASes present in the Internet Routing Table: 14432 APNIC Prefixes per ASN: 17.32 APNIC Region origin ASes announcing only one prefix: 4401 APNIC Region transit ASes present in the Internet Routing Table: 1901 Average APNIC Region AS path length visible: 5.5 Max APNIC Region AS path length visible: 39 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9867 Number of APNIC addresses announced to Internet: 756798080 Equivalent to 45 /8s, 27 /16s and 210 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 282780 Total ARIN prefixes after maximum aggregation: 126258 ARIN Deaggregation factor: 2.24 Prefixes being announced from the ARIN address blocks: 285603 Unique aggregates announced from the ARIN address blocks: 135775 ARIN Region origin ASes present in the Internet Routing Table: 19195 ARIN Prefixes per ASN: 14.88 ARIN Region origin ASes announcing only one prefix: 6978 ARIN Region transit ASes present in the Internet Routing Table: 2010 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 36 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5060 Number of ARIN addresses announced to Internet: 1267018496 Equivalent to 75 /8s, 133 /16s and 43 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 268526 Total RIPE prefixes after maximum aggregation: 129792 RIPE Deaggregation factor: 2.07 Prefixes being announced from the RIPE address blocks: 265469 Unique aggregates announced from the RIPE address blocks: 168869 RIPE Region origin ASes present in the Internet Routing Table: 28799 RIPE Prefixes per ASN: 9.22 RIPE Region origin ASes announcing only one prefix: 12136 RIPE Region transit ASes present in the Internet Routing Table: 3983 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 43 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12100 Number of RIPE addresses announced to Internet: 722111360 Equivalent to 43 /8s, 10 /16s and 139 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 122977 Total LACNIC prefixes after maximum aggregation: 28570 LACNIC Deaggregation factor: 4.30 Prefixes being announced from the LACNIC address blocks: 120501 Unique aggregates announced from the LACNIC address blocks: 48600 LACNIC Region origin ASes present in the Internet Routing Table: 11167 LACNIC Prefixes per ASN: 10.79 LACNIC Region origin ASes announcing only one prefix: 2633 LACNIC Region transit ASes present in the Internet Routing Table: 2483 Average LACNIC Region AS path length visible: 6.0 Max LACNIC Region AS path length visible: 56 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9083 Number of LACNIC addresses announced to Internet: 177433856 Equivalent to 10 /8s, 147 /16s and 109 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 32988 Total AfriNIC prefixes after maximum aggregation: 6572 AfriNIC Deaggregation factor: 5.02 Prefixes being announced from the AfriNIC address blocks: 44295 Unique aggregates announced from the AfriNIC address blocks: 14445 AfriNIC Region origin ASes present in the Internet Routing Table: 1899 AfriNIC Prefixes per ASN: 23.33 AfriNIC Region origin ASes announcing only one prefix: 691 AfriNIC Region transit ASes present in the Internet Routing Table: 368 Average AfriNIC Region AS path length visible: 5.9 Max AfriNIC Region AS path length visible: 30 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1258 Number of AfriNIC addresses announced to Internet: 103918592 Equivalent to 6 /8s, 49 /16s and 172 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 10088 8753 88 CHINAMOBILE-CN China Mobile Communication 7545 6062 840 654 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4872 4192 74 ERX-CERNET-BKB China Education and Resear 18403 4261 347 23 FPT-AS-AP FPT Telecom Company, VN 7552 3908 1331 25 VIETEL-AS-AP Viettel Group, VN 9498 3853 513 267 BBIL-AP BHARTI Airtel Ltd., IN 7713 3653 1036 71 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3261 1869 99 VNPT-AS-VN VNPT Corp, VN 24560 2785 830 542 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2287 11520 586 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 11003 11932 3878 AMAZON-02, US 11492 4661 310 548 CABLEONE, US 174 4439 8755 825 COGENT-174, US 7155 4163 287 85 VIASAT-SP-BACKBONE, US 6327 3605 1320 79 SHAW, CA 22773 3416 3035 188 ASN-CXA-ALL-CCI-22773-RDC, US 749 3262 54896 2509 DNIC-AS-00749, US 7018 3150 23660 1977 ATT-INTERNET4, US 396982 2865 3654 419 GOOGLE-CLOUD-PLATFORM, US 16625 2851 1245 2124 AKAMAI-AS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7647 1709 143 UNI2-AS, ES 39891 4720 289 58 ALJAWWALSTC-AS, SA 20940 3879 3395 129 AKAMAI-ASN1, NL 9009 3699 319 1885 M247, RO 12389 2949 2295 880 ROSTELECOM-AS, RU 34984 2342 359 579 TELLCOM-AS, TR 212238 1848 135 1366 CDNEXT, GB 13188 1606 100 30 TRIOLAN, UA 8452 1568 1852 14 TE-AS TE-AS, EG 8551 1474 366 32 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11437 3224 542 UNINET, MX 10620 3543 494 943 Telmex Colombia S.A., CO 13999 2534 532 359 Mega Cable, S.A. de C.V., MX 11830 2007 369 64 Instituto Costarricense de Electricidad y 28573 1338 2310 261 Claro NXT Telecomunicacoes Ltda, BR 3816 1322 779 201 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6503 1160 374 163 Axtel, S.A.B. de C.V., MX 11664 1152 278 33 Techtel LMDS Comunicaciones Interactivas 6147 1112 369 22 Telefonica del Peru S.A.A., PE 22884 1064 97 371 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1627 593 29 RAYA-AS, EG 24863 1619 389 16 LINKdotNET-AS, EG 36992 1421 1519 283 ETISALAT-MISR, EG 29571 1370 87 58 ORANGE-COTE-IVOIRE, CI 36903 1249 554 96 MT-MPLS, MA 36935 986 523 45 Vodafone-, EG 20011 781 153 343 INTERNET-SOLUTIONS, ZA 37069 590 1099 13 MOBINIL, EG 6713 556 1861 35 IAM-AS, MA 36914 521 82 3 KENET-AS, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11437 3224 542 UNINET, MX 16509 11003 11932 3878 AMAZON-02, US 9808 10088 8753 88 CHINAMOBILE-CN China Mobile Communication 12479 7647 1709 143 UNI2-AS, ES 7545 6062 840 654 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4872 4192 74 ERX-CERNET-BKB China Education and Resear 39891 4720 289 58 ALJAWWALSTC-AS, SA 11492 4661 310 548 CABLEONE, US 174 4439 8755 825 COGENT-174, US 18403 4261 347 23 FPT-AS-AP FPT Telecom Company, VN Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 10088 10000 CHINAMOBILE-CN China Mobile Communications Grou 12479 7647 7504 UNI2-AS, ES 16509 11003 7125 AMAZON-02, US 7545 6062 5408 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4872 4798 ERX-CERNET-BKB China Education and Research Net 39891 4720 4662 ALJAWWALSTC-AS, SA 18403 4261 4238 FPT-AS-AP FPT Telecom Company, VN 11492 4661 4113 CABLEONE, US 7155 4163 4078 VIASAT-SP-BACKBONE, US 7552 3908 3883 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 65538 DOCUMENT 2.135.152.0/22 9198 KAZTELECOM-AS, KZ 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.139.88.0/24 Origin: 397244 RESERVED, ZZ 23.139.88.0/24 Transit: 33387 NOCIX, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.152.48.0/24 Origin: 46167 RESERVED, ZZ 23.152.48.0/24 Transit: 7018 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:36 /11:91 /12:295 /13:576 /14:1170 /15:2059 /16:13177 /17:8260 /18:13768 /19:24584 /20:44902 /21:52281 /22:112253 /23:100292 /24:591885 /25:726 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6695 7647 UNI2-AS, ES 8151 5654 11437 UNINET, MX 11492 3555 4661 CABLEONE, US 39891 3412 4720 ALJAWWALSTC-AS, SA 6327 3400 3605 SHAW, CA 7155 3107 4163 VIASAT-SP-BACKBONE, US 22773 2546 3416 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2249 11003 AMAZON-02, US 30036 2191 2530 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2173 3543 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2288 2:1553 3:511 4:8 5:4426 6:169 7:6 8:1509 9:1 11:172 12:1420 13:371 14:2494 15:331 16:265 17:359 18:901 20:441 21:4 22:188 23:6955 24:2650 25:2 27:2599 29:19 31:2962 32:47 34:70 35:143 36:2369 37:4452 38:8824 39:917 40:149 41:4077 42:2037 43:2471 44:328 45:17756 46:4710 47:300 49:2027 50:1859 51:580 52:1581 54:313 55:952 56:8 57:224 58:2256 59:1269 60:1149 61:2741 62:2832 63:1846 64:5386 65:2274 66:4648 67:2990 68:1332 69:4006 70:1127 71:573 72:2854 74:2793 75:1631 76:638 77:2583 78:1878 79:1662 80:2205 81:2034 82:1790 83:1387 84:1764 85:3119 86:967 87:2411 88:1247 89:4366 90:701 91:8268 92:2610 93:2812 94:3823 95:4284 96:1265 97:314 98:1070 99:738 100:73 101:1169 102:3369 103:32293 104:4418 105:705 106:987 107:2396 108:1172 109:4061 110:2224 111:3317 112:2046 113:1758 114:1938 115:2138 116:1991 117:2706 118:2848 119:1982 120:1893 121:1410 122:2719 123:2159 124:1639 125:2858 126:64 128:1361 129:941 130:1253 131:1877 132:811 133:446 134:1527 135:315 136:1262 137:1135 138:2859 139:1540 140:1479 141:1567 142:1812 143:1609 144:1024 145:399 146:2107 147:2053 148:2535 149:2827 150:1124 151:1443 152:2114 153:499 154:7125 155:1542 156:2911 157:1839 158:1216 159:2439 160:3270 161:1740 162:3567 163:1770 164:1935 165:2132 166:1338 167:1845 168:4097 169:787 170:4986 171:997 172:3913 173:3129 174:912 175:1250 176:3486 177:4811 178:3651 179:2215 180:2520 181:3921 182:3322 183:2030 184:2269 185:21187 186:5031 187:4241 188:4233 189:4158 190:9553 191:1513 192:11203 193:9272 194:7622 195:5378 196:3218 197:3324 198:6033 199:8207 200:8143 201:6283 202:10567 203:10427 204:4664 205:3679 206:4633 207:3648 208:4226 209:5154 210:4789 211:2679 212:4515 213:3642 214:1048 215:48 216:6653 217:3030 218:1383 219:556 220:2081 221:1050 222:837 223:2319 End of report

1 0

SSH bruteforce attempts from Verizon to "AS17452 Bitstop Inc"
by Neel Chauhan 01 Nov '24

01 Nov '24

Hi, I am a customer of Verizon Fios in NYC and received a very interesting abuse complaint today from abuse(a)verizon.com. I got SSH bruteforce attempts between my IP address and this IPv4 prefix: 202.91.160.0/20 This is hosted on a network called "AS17452 Bitstop Inc". My connection runs Tor relays, but not exit relays. I doubt it's Tor since when I had Google Fiber or CenturyLink even when running Tor relays I never got those complaints. I use a MikroTik core router so maybe it got malware, although I recently updated it from 7.15.3 to 7.16.1. I decided to filter the prefix. Maybe a Windows PC on our network is infected. Maybe it's my Rocky Linux servers. Should I probably get a Supermicro/Deciso box and run an OPNsense firewall instead? But I never got complaints from Frontier or Optimum when I put MikroTik routers on both ISPs too, that for accounts not in my name. Maybe it's a false positive and just TCP forgery pretending to me be (I hope so). Just letting you know. -Neel === REDACTED COMPLAINT BELOW === Dear Verizon Online Customer, On 10-30-2024, your account was reported to have been used in an attempt to gain unauthorized access to another system, or to transmit malicious traffic to another Internet user. It is possible that a device connected to your network may have been infected by a virus or a botnet that is causing this action. Report and/or Logs: To assist you in understanding the situation, we have provided the relevant log data below, with timestamps adjusted to our GMT +8 timezone: DateTime Action AttackClass SourceIP Srcport Protocol DestinationIP DestPort 0 30-Oct-2024 13:37:21 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 1 30-Oct-2024 13:49:38 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 2 30-Oct-2024 14:00:01 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 3 30-Oct-2024 14:10:12 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 4 30-Oct-2024 15:17:15 DENIED 108.30.XXX.XXX 32769 TCP 202.91.162.17 22 5 30-Oct-2024 15:18:29 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.39 22 6 30-Oct-2024 15:23:08 DENIED 108.30.XXX.XXX 54688 TCP 202.91.163.179 22 7 30-Oct-2024 15:30:22 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.47 22 8 30-Oct-2024 15:47:32 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 9 30-Oct-2024 15:58:03 DENIED 108.30.XXX.XXX 50405 TCP 202.91.163.143 22 Please immediately ensure your anti-virus and anti-malware software is properly updated. Please perform full system scans on your device(s). [Including - computers, tablets, cellular devices, network attached storage, security camera recorders (DVR or NVR), and IOT devices, where possible.] Additional information and removal guidance of detected malware may be found on the website of your scanner(s) manufacturer. It is difficult to verify the presence of an exact virus or malware infecting a device without a full system scan with up-to-date software. Installing the most recent firmware and software updates can also assist in securing your device(s). Please follow the device manufactures processes for any updates. If you are unable to take immediate action, it would be advisable to remove the device(s), which may be infected, from your network and the Internet connection until it has been properly cleaned. This may be easily done by unplugging the network cable that connects the device to the router. For wireless devices removing power from the device will keep it off it the network. Note: this information is being provided as a courtesy; you are solely responsible for any changes you make to your device(s) or network. Verizon Policy: If you do not take steps to resolve this issue, we may be forced to take further action. Actions could include the suspension or termination of your service until the issue is resolved, in order to ensure the safety of our network, and the safety of other Internet users. Please carefully review these agreements, which can be viewed at: http://www.verizon.com/about/terms/ Any future violation will result in further action being taken, up to, and including, the termination of your service. Sincerely, Verizon Global IP Abuse http://www.verizon.com/about/terms/ http://www.verizon.com/securityinfo Abuse(a)verizon.com

3 3